{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-53173", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-11-19T17:17:25.006Z", "datePublished": "2024-12-27T13:49:17.981Z", "dateUpdated": "2026-08-05T11:44:20.900Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:44:20.900Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4.0: Fix a use-after-free problem in the asynchronous open()\n\nYang Erkun reports that when two threads are opening files at the same\ntime, and are forced to abort before a reply is seen, then the call to\nnfs_release_seqid() in nfs4_opendata_free() can result in a\nuse-after-free of the pointer to the defunct rpc task of the other\nthread.\nThe fix is to ensure that if the RPC call is aborted before the call to\nnfs_wait_on_sequence() is complete, then we must call nfs_release_seqid()\nin nfs4_open_release() before the rpc_task is freed." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable code is the in-kernel NFSv4.0 client, driven by local `open()`/`openat()` syscalls on a mounted NFSv4.0 share (`nfs4_atomic_open` → `nfs4_do_open` → `nfs4_run_open_task`); the attacker must be able to issue file opens and signals on the local system. A malicious or unresponsive server only influences timing, it cannot initiate the opens itself.\nAC:L - The attacker controls both sides of the race: state owners are keyed by credential, so several threads of the same unprivileged user opening files on the same NFSv4.0 mount are forcibly serialized on one seqid list, and the attacker chooses the thread count, the open pattern, and when to abort them with fatal signals, retrying in a loop until the window is hit. An NFSv4.0 mount is a common, non-exotic deployment (and a server can negotiate the client down to 4.0), so no condition outside attacker control is required.\nPR:L - Any unprivileged local user with access to an NFSv4.0 mount can trigger this — the path is reached through the ordinary `open()` syscall with no capability, and the aborts are just fatal signals delivered to the attacker's own threads. No root or CAP_* is checked anywhere along `nfs_atomic_open` → `nfs4_do_open` → `nfs4_open_prepare`/`nfs4_open_release`.\nUI:N - The attacker's own multi-threaded process performs the opens and the aborts; no action by another user or administrator is needed beyond the NFSv4.0 mount already being present in the target environment.\nS:U - The use-after-free corrupts kernel heap objects (`struct rpc_task`) within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The freed `rpc_task` slot can be reclaimed by attacker-driven allocations, and the stale pointer is then dereferenced through `rpc_wake_up_queued_task()`/`__rpc_execute()`, giving a use-after-free read of reclaimed kernel data and a route to disclosing kernel memory and pointers.\nI:H - The dangling pointer is written through, not just read: `__rpc_remove_wait_queue()` performs `list_del` into the freed object and its neighbors, `rpc_make_runnable()` writes `INIT_WORK(&task->u.tk_work, ...)` and queues it, after which `__rpc_execute()` invokes `task->tk_action`/`task->tk_callback` function pointers read from the freed slot — a control-flow hijack / arbitrary-write primitive after heap grooming.\nA:H - Even unexploited, waking a freed `rpc_task` corrupts the sunrpc wait-queue lists and dereferences garbage function pointers, reliably producing a kernel oops/panic; the attacker can repeat the trigger at will." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/nfs/nfs4proc.c" ], "versions": [ { "version": "24ac23ab88df5b21b5b2df8cde748bf99b289099", "lessThan": "1cfae9575296f5040cdc84b0730e79078c081d2d", "status": "affected", "versionType": "git" }, { "version": "24ac23ab88df5b21b5b2df8cde748bf99b289099", "lessThan": "7bf6bf130af8ee7d93a99c28a7512df3017ec759", "status": "affected", "versionType": "git" }, { "version": "24ac23ab88df5b21b5b2df8cde748bf99b289099", "lessThan": "5237a297ffd374a1c4157a53543b7a69d7bbbc03", "status": "affected", "versionType": "git" }, { "version": "24ac23ab88df5b21b5b2df8cde748bf99b289099", "lessThan": "2ab9639f16b05d948066a6c4cf19a0fdc61046ff", "status": "affected", "versionType": "git" }, { "version": "24ac23ab88df5b21b5b2df8cde748bf99b289099", "lessThan": "ba6e6c04f60fe52d91520ac4d749d372d4c74521", "status": "affected", "versionType": "git" }, { "version": "24ac23ab88df5b21b5b2df8cde748bf99b289099", "lessThan": "229a30ed42bb87bcb044c5523fabd9e4f0e75648", "status": "affected", "versionType": "git" }, { "version": "24ac23ab88df5b21b5b2df8cde748bf99b289099", "lessThan": "e2277a1d9d5cd0d625a4fd7c04fce2b53e66df77", "status": "affected", "versionType": "git" }, { "version": "24ac23ab88df5b21b5b2df8cde748bf99b289099", "lessThan": "b56ae8e715557b4fc227c9381d2e681ffafe7b15", "status": "affected", "versionType": "git" }, { "version": "24ac23ab88df5b21b5b2df8cde748bf99b289099", "lessThan": "2fdb05dc0931250574f0cb0ebeb5ed8e20f4a889", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/nfs/nfs4proc.c" ], "versions": [ { "version": "2.6.16", "status": "affected" }, { "version": "0", "lessThan": "2.6.16", "status": "unaffected", "versionType": "semver" }, { "version": "4.19.325", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.287", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.231", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.174", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.120", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.64", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11.11", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.2", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.16", "versionEndExcluding": "4.19.325" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.16", "versionEndExcluding": "5.4.287" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.16", "versionEndExcluding": "5.10.231" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.16", "versionEndExcluding": "5.15.174" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.16", "versionEndExcluding": "6.1.120" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.16", "versionEndExcluding": "6.6.64" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.16", "versionEndExcluding": "6.11.11" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.16", "versionEndExcluding": "6.12.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.16", "versionEndExcluding": "6.13" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/1cfae9575296f5040cdc84b0730e79078c081d2d" }, { "url": "https://git.kernel.org/stable/c/7bf6bf130af8ee7d93a99c28a7512df3017ec759" }, { "url": "https://git.kernel.org/stable/c/5237a297ffd374a1c4157a53543b7a69d7bbbc03" }, { "url": "https://git.kernel.org/stable/c/2ab9639f16b05d948066a6c4cf19a0fdc61046ff" }, { "url": "https://git.kernel.org/stable/c/ba6e6c04f60fe52d91520ac4d749d372d4c74521" }, { "url": "https://git.kernel.org/stable/c/229a30ed42bb87bcb044c5523fabd9e4f0e75648" }, { "url": "https://git.kernel.org/stable/c/e2277a1d9d5cd0d625a4fd7c04fce2b53e66df77" }, { "url": "https://git.kernel.org/stable/c/b56ae8e715557b4fc227c9381d2e681ffafe7b15" }, { "url": "https://git.kernel.org/stable/c/2fdb05dc0931250574f0cb0ebeb5ed8e20f4a889" } ], "title": "NFSv4.0: Fix a use-after-free problem in the asynchronous open()", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH" } }, { "other": { "type": "ssvc", "content": { "id": "CVE-2024-53173", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "version": "2.0.3", "timestamp": "2025-02-11T15:43:40.051195Z" } } } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free" } ] } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-11T15:45:27.018Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T20:47:06.823Z" } } ] } }